Django Timing Attack Vulnerability in mod_wsgi Authentication Handler Allows User Enumeration

A vulnerability exists in Django versions 6.0 prior to 6.0.2, 5.2 prior to 5.2.11, and 4.2 prior to 4.2.28. The issue arises in the 'django.contrib.auth.handlers.modwsgi.check_password()' function, which is used for authentication via mod_wsgi. This vulnerability allows remote attackers to enumerate users by exploiting a timing attack. While earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated, they may also be affected.

Impact

Exploitation of this vulnerability could lead to user enumeration, allowing attackers to identify valid usernames.

Remediation

Users can upgrade to Django versions 6.0.2, 5.2.11, or 4.2.28 to address this vulnerability.